Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we collect: name, email address, phone number, organization name, role/designation, and billing information.

1.2 Health Information (PHI)

As a healthcare platform, we process Protected Health Information (PHI) on behalf of our customers (covered entities). This includes patient demographics, medical records, diagnoses, prescriptions, lab results, and billing records. We act as a Business Associate under HIPAA.

1.3 Usage Data

We automatically collect: IP address, browser type, pages visited, timestamps, device information, and feature usage analytics (anonymized).

2. How We Use Your Information

• Providing and maintaining the IdeaDunes Healthcare platform
• Processing billing and subscription management
• Sending service updates, security alerts, and support communications
• Improving our products through anonymized usage analytics
• Complying with legal obligations and healthcare regulations
• Responding to your inquiries and support requests

3. Data Protection & Security

We implement industry-standard security measures:

• Encryption: AES-256 at rest, TLS 1.3 in transit
• Access Controls: Role-based access control (RBAC) with principle of least privilege
• Audit Logging: Complete audit trail of all data access and modifications
• Authentication: Multi-factor authentication (MFA/2FA) support
• Backups: Automated daily backups with 30-day retention and point-in-time recovery
• Infrastructure: Tier-1 data centers (AWS/Azure) with SOC 2 compliance

4. Data Sharing & Third Parties

We do not sell your personal or health information. We may share data with:

• Cloud infrastructure providers (AWS, Azure) for hosting — under BAA
• Payment processors for billing — PCI DSS compliant
• ABDM/ABHA for health record exchange — with patient consent
• Law enforcement — only when legally required with valid court order

5. Your Rights

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Export your data in standard formats
• Withdraw consent for optional data processing
• Lodge a complaint with relevant data protection authorities

6. Data Retention

We retain account data for the duration of your subscription plus 90 days. Health/medical records are retained as per applicable healthcare regulations (typically 7-10 years as mandated by law). You may request data export and deletion at any time.

7. Cookies

We use essential cookies for authentication and session management. We use anonymized analytics cookies to improve our platform. You can control cookie preferences through your browser settings.

8. Children's Privacy

Our service is not directed at children under 18. We do not knowingly collect personal information from minors. Pediatric patient records are managed by authorized healthcare providers, not directly by minors.

9. International Data Transfers

For Indian customers, data is stored within India (Mumbai/Chennai data centers). For international customers, data may be processed in the region of your choosing. We comply with applicable data transfer regulations including GDPR Standard Contractual Clauses.

10. India — DPDP Act 2023

For Indian customers, IdeaDunes complies with the Digital Personal Data Protection Act, 2023 (DPDP Act):

• Consent-based processing: Clear, informed consent obtained before collecting personal data
• Purpose limitation: Data used strictly for stated purposes with no secondary usage
• Data localization: Indian customer data stored in India (Mumbai/Chennai data centers)
• Grievance redressal: Dedicated Grievance Officer responds within 15 days
• Right to erasure: Users can request complete data deletion (subject to healthcare retention laws)
• Breach notification: Mandatory reporting to DPBI (Data Protection Board of India) within 72 hours

11. Related Compliance Pages

12. Contact Us

For privacy-related inquiries, data requests, or complaints: